Start here
GHOST SCAN
Free Website Security Scan
The fast website security checker: a free surface-level vulnerability check across nine categories. Enter your target below. When you need a deeper, human-led test, step up to the $2,499 VAPT or our PhantomDragon AI engine.
No card. No signup. Nothing stored.
SYSTEM_CHECKS
What do we check?
Nine categories of security and performance checks, the same things attackers look for first.
SSL / HTTPS
Certificate validity, secure connection, and modern TLS protocols
Security Headers
HSTS, CSP, X-Frame-Options, COOP, CORP, and 9 header checks
HTTPS Redirect
HTTP to HTTPS redirect enforcement
Email Security
SPF, DMARC, and DKIM DNS records
Content Files
robots.txt and sitemap.xml presence
Cookie Security
Secure, HttpOnly, and SameSite flags
Performance
Response time, compression, caching, and page size
Advanced Security
CORS, mixed content, source maps, info disclosure, open redirects
DNS Infrastructure
DNSSEC, CAA records, MX presence, NS redundancy
SCOPE
What the free scan does not cover
Ghost Scan reads what your site exposes publicly. It never logs in, never sends attack payloads, and cannot see business-logic flaws. As a website security checker it covers the nine surface categories above; it does not test authentication, authorization, or anything behind a login.
When you need depth, there are two steps up. The $499 Security Scan points PhantomDragon's 75+ scanner modules at your app, covers the OWASP Top 10, and delivers an executive PDF report plus CSV export in 48 hours. The $2,499 penetration test adds a real engineer: manual exploitation, business-logic testing, a free re-test after fixes, and a signed attestation letter, delivered in 5 to 7 days.
Launching soon? Run the free scan now, then read our guide to penetration testing before launch. Ghost Scan is a free surface scan run by a Colombo-based security firm, delivered worldwide.
FAQ
Frequently asked
Is this really free?
Yes: basic security scans are free forever. No signup, no credit card, no catch. We built this to help make the web safer.
What does the free scan check?
This website security checker runs nine categories of checks: SSL/TLS, security headers, HTTPS redirect, email security (SPF, DMARC, DKIM), content files, cookie security, performance, advanced security, and DNS infrastructure. Each failed check comes with a specific fix.
What’s the difference vs a penetration test?
Ghost Scan is an automated surface-level check, it looks at publicly visible configuration. A penetration test is a manual deep-dive: in our fixed $2,499 engagement a real engineer actively tries to exploit vulnerabilities in your application logic, authentication, and infrastructure.
Is my data stored?
No. Scan results are generated in real-time and not stored on our servers. Nothing is logged or persisted.
How can I improve my score?
Each failed check includes a specific recommendation. The priority fixes section sorts them by impact so you can tackle the biggest wins first. Download the PDF report for a shareable action plan.
Can I embed my score badge?
Yes! After scanning, you’ll find an embeddable badge with HTML code. Add it to your README, footer, or marketing site to showcase your security posture.
Need professional security services?